> For the complete documentation index, see [llms.txt](https://estebanzarate.gitbook.io/hackache/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://estebanzarate.gitbook.io/hackache/networks/networks.md).
# Networks
Conjunto de dispositivos interconectados que pueden comunicarse.
## Types
| **Network Type** | **Definition** |
| ---------------------------------- | -------------------------------------------- |
| Wide Area Network (WAN) | Internet |
| Local Area Network (LAN) | Internal Networks (Ex: Home or Office) |
| Wireless Local Area Network (WLAN) | Internal Networks accessible over Wi-Fi |
| Virtual Private Network (VPN) | Connects multiple network sites to one `LAN` |
## Network Topologies
A **network topology** defines how devices are arranged and connected in a network, either physically (cables/hardware layout) or logically (how data flows).
### Key Components
* **Connections:** Wired (coaxial, fiber, twisted-pair) or Wireless (Wi-Fi, cellular, satellite)
* **Nodes:** Devices at connection points — routers, switches, hubs, firewalls, etc.
### Types of Topology
| Topology | Description |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------- |
| **Point-to-Point** | Direct link between exactly two hosts. Simplest type. |
| **Bus** | All hosts share one transmission medium. Only one can send at a time. |
| **Star** | All hosts connect to a central device (switch/router/hub). Most common in LANs. |
| **Ring** | Each host connects to two others forming a ring. Data travels in one direction. |
| **Mesh** | Hosts interconnect with each other. *Fully meshed* = every host linked; *Partially meshed* = some links only. High reliability. |
| **Tree** | Extended star topology. Hierarchical structure, common in large buildings. |
| **Hybrid** | Combination of two or more different topologies. |
| **Daisy Chain** | Hosts connected in a series, one after another. Common in automation. |
## Proxies
A **proxy** is a device or service that sits **in the middle of a connection** and acts as a mediator — meaning it can inspect the contents of the traffic. If it can't inspect traffic, it's a **gateway**, not a proxy.
> Proxies almost always operate at **Layer 7 of the OSI Model**.
### Types of Proxy
#### 1. Forward Proxy (Dedicated Proxy)
* The client sends a request → proxy carries it out on the client's behalf.
* **Use cases:**
* Corporate networks use them to control/filter internet access.
* Acts as a defense against malware (malware must be proxy-aware to bypass it).
* Example tool: **Burp Suite** (intercepts HTTP requests).
#### 2. Reverse Proxy
* Filters **incoming** requests instead of outgoing ones.
* Listens on an address and forwards traffic to an internal/closed network.
* **Use cases:**
* **Cloudflare** — absorbs DDoS attacks and filters traffic before it hits a web server.
* **ModSecurity (WAF)** — inspects and blocks malicious web requests.
* Pen testers use them on infected endpoints to bypass firewalls or evade IDS logging.
#### 3. Transparent Proxy
* The client **doesn't know it exists** — traffic is intercepted silently.
* Acts as a substitute for the client without any special configuration needed.
#### 4. Non-Transparent Proxy
* The client **must be configured** to use it explicitly.
* Without the correct proxy settings, communication to the internet is cut off.
## Networking Models
Two models describe how data is communicated between hosts: **OSI** and **TCP/IP**. Both represent data transfer as a series of layers.
### The OSI Model
* Stands for **Open Systems Interconnection**, published by ITU and ISO.
* Has **7 layers**, each with clearly separated tasks.
* Used as a **reference model** — stricter protocols, more detailed.
* Useful for analyzing network traffic **piece by piece**.
| # | Layer | PDU |
| - | ------------ | ------------------ |
| 7 | Application | Data |
| 6 | Presentation | Data |
| 5 | Session | Data |
| 4 | Transport | Segment / Datagram |
| 3 | Network | Packet |
| 2 | Data-Link | Frame |
| 1 | Physical | Bit |
### The TCP/IP Model
* Stands for **Transmission Control Protocol / Internet Protocol**.
* A generic term for an entire protocol family (includes ICMP, UDP, etc.).
* Has **4 layers**, with more flexible rules than OSI.
* The foundation of how the **entire Internet** works.
| Layer | Equivalent OSI Layers |
| ----------- | --------------------- |
| Application | 5, 6, 7 |
| Transport | 4 |
| Internet | 3 |
| Link | 1, 2 |
### Packet Transfers & Encapsulation
* Data travels **down the layers** on the sender's side and **up the layers** on the receiver's side.
* At each layer, a **header is added** to the PDU from the layer above — this is called **encapsulation**.
* The receiver **unpacks** each header in reverse order until the application gets the raw data.
## IP Addresses
Every host in a network is identified by two types of addresses:
* **MAC address** — identifies the exact device within a local network (floor & apartment).
* **IP address (IPv4/IPv6)** — identifies the network and host for routing across networks (postal address & district).
***
### IPv4 Structure
* Made up of **32 bits** → split into **4 octets** (8 bits each), ranging from 0–255.
* Written in **dotted-decimal notation** (e.g., `192.168.10.39`).
* Allows up to **4,294,967,296** unique addresses.
* Divided into a **network part** (assigned by admin/IANA) and a **host part** (assigned by router/admin).
***
### IPv4 Classes
| Class | Range | Subnet Mask | CIDR | Use |
| ----- | --------------------------- | ------------- | ---- | --------------- |
| A | 1.0.0.0 – 127.255.255.255 | 255.0.0.0 | /8 | Large networks |
| B | 128.0.0.0 – 191.255.255.255 | 255.255.0.0 | /16 | Medium networks |
| C | 192.0.0.0 – 223.255.255.255 | 255.255.255.0 | /24 | Small networks |
| D | 224.0.0.0 – 239.255.255.255 | — | — | Multicast |
| E | 240.0.0.0 – 255.255.255.255 | — | — | Reserved |
***
### Special Addresses in a Subnet
* **Network address** — first IP, identifies the subnet itself (not assignable to a host).
* **Broadcast address** — last IP, sends data to all devices in the network simultaneously.
* **Default gateway** — usually the first or last *assignable* IP; the router that connects networks.
***
### Binary & Octet Values
Each octet is 8 bits with positional values: `128 | 64 | 32 | 16 | 8 | 4 | 2 | 1`
Example — `192.168.10.39`:
| Octet | Binary | Decimal |
| ----- | ----------- | ------- |
| 1st | `1100 0000` | 192 |
| 2nd | `1010 1000` | 168 |
| 3rd | `0000 1010` | 10 |
| 4th | `0010 0111` | 39 |
The **subnet mask** is calculated the same way. Example — `255.255.255.0`:
| Octet | Binary | Decimal |
| ----- | ----------- | ------- |
| 1st | `1111 1111` | 255 |
| 2nd | `1111 1111` | 255 |
| 3rd | `1111 1111` | 255 |
| 4th | `0000 0000` | 0 |
***
### Subnet Mask & CIDR
* The **subnet mask** defines which bits belong to the network vs. the host.
* **CIDR (Classless Inter-Domain Routing)** replaces fixed class assignments, allowing subnets of any size.
* The **CIDR suffix** = total number of `1` bits in the subnet mask.
```
192.168.10.39 + 255.255.255.0 → 192.168.10.39/24
```
(`/24` because there are 24 ones in `1111 1111 . 1111 1111 . 1111 1111 . 0000 0000`)
## Protocols
Protocols are standardized rules that determine the formatting and processing of data to facilitate communication between devices in a network.
## Transmission
Transmission in networking refers to the process of sending data signals over a medium from one device to another.
### Transmission Types
#### Analog
Analog transmission uses continuous signals to represent information.
#### Digital
Digital transmission employs discrete signals (bits) to encode data.
### Transmission Modes
#### Simplex
Allows one-way communication only, where signals travel in a single direction.
#### Half-duplex
Permits two-way communication but not simultaneously.
#### Full-duplex
Supports two-way communication simultaneously.
### Transmission Media
The physical means by which data is transmitted in a network.
#### Wired
* Twisted pair cables
* Coaxial cables
* Fiber optic cables
#### Wireless
* Radio waves for Wi-Fi and cellular networks
* Microwaves for satellite communications
* Infrared technology is used for short-range communications, like remote controls
## Components of a Network
| **Component** | **Description** |
| --------------------------------------- | --------------------------------------------------------- |
| `End Devices` | Computers, Smartphones, Tablets, IoT / Smart Devices |
| `Intermediary Devices` | Switches, Routers, Modems, Access Points |
| `Network Media and Software Components` | Cables, Protocols, Management and Firewalls Software |
| `Servers` | Web Servers, File Servers, Mail Servers, Database Servers |
## MAC (Media Access Control) Addresses
Unique identifier assigned to the network interface card (NIC) of a device, allowing it to be recognized on a local network.
The first 24 bits represent the Organizationally Unique Identifier (OUI) assigned to the manufacturer.
The remaining 24 bits are specific to the individual device.
* [getmac](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/getmac)
```powershell
getmac
```
## IP (Internet Protocol) Addresses
A numerical label assigned to each device connected to a network.
## Ports
Number assigned to specific processes or services on a network.
* [netstat](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat)
```powershell
netstat
```
* Well-Known Ports (0-1023)
* Registered Ports (1024-49151)
* Dynamic/Private Ports (49152-65535)
## Dynamic Host Configuration Protocol (DHCP)
Allows devices to automatically receive an IP address and other network configuration parameters, such as subnet mask, default gateway, and DNS servers.
## Network Address Translation (NAT)
A process carried out by a router or similar device that modifies the source or destination IP address in the headers of IP packets as they pass through, used to translate the private IP addresses of devices within a local network to a single public IP address assigned to the router.
### Types of NAT
| **Type** | **Description** |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Static NAT` | Involves a one-to-one mapping, where each private IP address corresponds directly to a public IP address. |
| `Dynamic NAT` | Assigns a public IP from a pool of available addresses to a private IP as needed, based on network demand. |
| `Port Address Translation (PAT)` | Also known as NAT Overload, is the most common form of NAT in home networks. Multiple private IP addresses share a single public IP address, differentiating connections by using unique port numbers. This method is widely used in home and small office networks, allowing multiple devices to share a single public IP address for internet access. |
## Public IP Addresses
Globally unique identifiers assigned by Internet Service Providers (ISPs).
## Private IP Addresses
* [Address Allocation for Private Internets - RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918)
Designated for use within local networks.
## Domain Name System (DNS)
Helps us find the right IP address for a given domain.
### DNS Hierarchy
| **Layer** | **Description** |
| -------------------------- | --------------------------------------------------------------------------------- |
| `Root Servers` | The top of the DNS hierarchy. |
| `Top-Level Domains (TLDs)` | Such as `.com`, `.org`, `.net`, or country codes like `.uk`, `.de`. |
| `Second-Level Domains` | For example, `example` in `example.com`. |
| `Subdomains or Hostname` | For instance, `www` in `www.example.com`, or `accounts` in `accounts.google.com`. |
### DNS Resolution Process (Domain Translation)
| **Step** | **Description** |
| -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Step 1` | We type `www.example.com` into our browser. |
| `Step 2` | Our computer checks its local DNS cache (a small storage area) to see if it already knows the IP address. |
| `Step 3` | If not found locally, it queries a `recursive DNS server`. This is often provided by our Internet Service Provider or a third-party DNS service like Google DNS. |
| `Step 4` | The recursive DNS server contacts a `root server`, which points it to the appropriate `TLD name server` (such as the `.com` domains, for instance). |
| `Step 5` | The TLD name server directs the query to the `authoritative name server` for `example.com`. |
| `Step 6` | The authoritative name server responds with the IP address for `www.example.com`. |
| `Step 7` | The recursive server returns this IP address to your computer, which can then connect to the website’s server directly. |
## Internet Architecture
| Architecture | Centralized | Scalability | Ease of Management | Typical Use Cases |
| --------------- | ------------------------------- | -------------------- | ---------------------------------- | ---------------------------------- |
| `P2P` | Decentralized (or partial) | High (as peers grow) | Complex (no central control) | File-sharing, blockchain |
| `Client-Server` | Centralized | Moderate | Easier (server-based) | Websites, email services |
| `Hybrid` | Partially central | Higher than C-S | More complex management | Messaging apps, video conferencing |
| `Cloud` | Centralized in provider’s infra | High | Easier (outsourced) | Cloud storage, SaaS, PaaS |
| `SDN` | Centralized control plane | High (policy-driven) | Moderate (needs specialized tools) | Datacenters, large enterprises |
## Firewalls
A network security device, either hardware, software, or a combination of both, that monitors incoming and outgoing network traffic and enforces a set of rules to determine whether to allow or block specific traffic.
## Intrusion Detection Systems (IDS)
Observes traffic or system events to identify malicious behavior or policy violations, generating alerts but not blocking the suspicious traffic.
## Intrusion Prevention Systems (IPS)
Takes an additional step by preventing or rejecting malicious traffic in real time.
*